[AMQ-9197] Prototype Javascript Framework - CVE-2020-27511

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.16.3, 5.16.4, 5.16.5
• Fix Version/s: 5.18.0, 5.16.6, 5.17.4
• Component/s: Web Console
• Assignee: Jean-Baptiste Onofré
• Reporter: Nikhil
• Created: 16/Jan/23 04:48
• Updated: 09/Feb/23 03:49
• Resolved: 08/Feb/23 16:23

Description

An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.1 version 1.6 and below where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags.

 

See https://nvd.nist.gov/vuln/detail/CVE-2020-27511 for further details

 

prototype.js is part of activemq-web-5.16.3.jar which is shipped inside activemq-web-console.war

 

Can someone please confirm the affected projects of activeMQ for this prototype.js library..